Post-mortem: response to the critical PHP vulnerabilities of October 2026

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that allow unauthenticated remote code execution. Because the fynk app runs on PHP, we applied preventive measures as soon as the release was announced and updated production to the fixed version on the day of the release. Applying the patches worked as planned, and based on our assessment, we found no evidence of attempted attacks. This post documents the measures we took, the timeline and the current status.

Vulnerabilities

The PHP security team announced the release on 20 October without technical details. On 21 October, it published fixed versions for all supported branches (8.5.12, 8.4.27, 8.3.36 and 8.2.35) together with two advisories:

• CVE-2026-109618: remote code execution through memory corruption in the handling of file uploads and their size limits.
• CVE-2026-109619: remote code execution through global state that persists between requests when upload progress tracking is enabled.

Both can be triggered by a crafted request to any server that accepts file uploads through PHP. Neither requires authentication. More technical information on both vulnerabilities is available at php2shell.com.

Measures

Before the release. Following the announcement, we reduced the attack surface before any details were public:

• Shut down all systems not required for operation, including internal test environments and internal tools that are not part of the fynk app.
• Deployed a firewall rule that blocked the request type both vulnerabilities depend on before it could reach the fynk app.
• Disabled the PHP feature targeted by CVE-2026-109619.
• Put the fynk app into maintenance mode shortly before the vulnerabilities and fixes were published, as announced earlier that day.

After the release. We patched production to PHP 8.4.27, verified the running version and brought the fynk app back online. The total downtime was about half an hour.

Timeline

All times are CEST and approximate.

• 20 October: The PHP security team announces a critical security release for the following day.
• 21 October, around midday: Shutdown of non-essential systems begins.
• 21 October, early afternoon: The firewall rule is active. We announce a maintenance window for the afternoon.
• 21 October, around 15:00: The PHP feature targeted by CVE-2026-109619 is disabled.
• 21 October, around 15:50: The fynk app enters maintenance mode. Shortly afterwards, PHP publishes the vulnerability details and fixed versions, and the update starts.
• 21 October, around 16:20: Production runs PHP 8.4.27 and the fynk app is available again.

Security findings and assessment

Based on our current knowledge, our infrastructure setup and systems were likely not affected by these vulnerabilities. As an additional measure, we deployed the firewall rule before technical details were published. We found no evidence of attempted attacks and no indication that customer data was accessed or exfiltrated.

Subprocessors

There is no indication that any of our subprocessors were affected by these vulnerabilities. We are nevertheless monitoring the situation closely with them. Should this change in a way that affects customer data, we will notify affected customers directly.

Current status and next steps

• The fynk app and all customer-facing services are fully operational on the fixed PHP version.
• Some internal tools remain offline until their vendors release patched versions. None of them are part of the fynk app or process customer contracts.
• We continue to monitor PHP security releases and new findings on these vulnerabilities, and will update this post if our assessment changes.

Contact

For questions, or for additional information for your own security review, contact [email protected]. Further information on our security measures is available on our security and GDPR page.